trygga privacy notice
Version 1.0 — effective from 1 September 2026
This notice covers the trygga.io website and the app at app.trygga.io.
Who is responsible?
Simo BV, Merktweg 1, 9772 Kruisem, Belgium, company and VAT number BE1016683031. For questions about your data, email hello@trygga.io.
Do you work in trygga for or with an agency?
trygga is a tool for agencies. We manage what you put into or see in a workspace, such as tasks, messages, documents, files and recorded time, on behalf of that workspace’s agency. The agency is responsible for that data and we act as processor. If you have a question about it or want it deleted, contact the agency. If we receive such a request, we forward it.
If you are a guest, the agency invited you to a project. That is why you receive emails from trygga bearing the agency’s name.
The rest of this notice covers data for which we are responsible ourselves.
Which data do we use and why?
Website enquiries. When you make an enquiry, we receive your name, business email address, agency, chosen enquiry type and plan preferences, and your message if you add one. The form also sends the page from which you made the enquiry. We use this to handle your enquiry and reply. If you are self-employed and request an agreement, we do this at your request as a step before entering into that agreement. If you act on behalf of a business or ask another question, we rely on our legitimate interest in handling business enquiries and questions about trygga.
Your account in the app. Your name, email address, profile photo if you choose one, language, time zone and password if you set one. We do not store your password in readable form. We need this data to let you sign in and provide trygga to the agency you work for or with. For the administration of your sign-in details, we rely on our legitimate interest in giving users secure access to the service. If you are our contracting party yourself, we process the data needed to perform our agreement with you.
Customer and billing details. For the person who subscribes to a workspace for an agency: name, email address, company details and plan arrangements. If you are our contracting party yourself, we use this to perform the agreement. For a business’s contact people, we rely on our legitimate interest in managing the customer relationship. We also process and retain invoice details to meet our legal accounting and tax obligations.
Emails from trygga. trygga sends emails to let you sign in, invite you and tell you what has happened in your workspace: notifications, a daily summary and a weekly summary. New users also receive a one-off series of five tip emails. Managing email delivery and the delivery record is based on our legitimate interest in operating the service reliably. We send project notifications on behalf of the agency. The five tip emails contain only guidance on using trygga. We rely on our legitimate interest in helping new users get started. Sign-in and invitation emails are part of the service and cannot be turned off. You can turn off notifications and summaries using the link at the bottom of each email or in your profile. Stop the tips using the link in a tip email. We keep a record for 30 days of which email we sent, when and to whom, to avoid sending too many and to investigate problems.
Support enquiries. When you ask a question through the support page, we send it to our mailbox with your name, email address, role, workspace name, the screen you came from, language, browser and the time. This helps us understand your question and reply. We rely on our legitimate interest in helping users and resolving problems. We keep support emails for up to one year after the last reply.
Operation and security. On each visit, the servers process technical data, such as your IP address and information about your browser and requests. On the website, Cloudflare Turnstile checks whether an enquiry comes from a real visitor, and we limit form submission attempts. In the app, we limit how often sign-in links and invitations are sent. Supabase Pro platform logs accessible to us are available for 7 days; Vercel Pro runtime logs for 1 day. These are the default periods without additional log storage. The suppliers’ own retention rules apply to their technical and security logs. We rely on our legitimate interest in keeping trygga secure.
We do not use your data for advertising, sell it or make automated decisions about you with legal or similarly significant effects.
Cookies and storage in your browser
Website. The website uses no advertising tracking or analytics tool. Cloudflare processes technical data for operation, security and spam prevention. You can read more in Cloudflare’s privacy notice.
App. The app uses only cookies needed for it to work. These do not require consent.
| Cookie | Purpose | Duration |
|---|---|---|
sb-…-auth-token |
Keeps you signed in | Until you sign out, up to 400 days |
trygga-workspace |
Remembers your last workspace | 1 year |
trygga-locale |
Remembers your language | 1 year |
post_login_redirect |
Takes you to the page you wanted after signing in | 1 hour |
The app also stores data in your browser. Text you have typed but not yet sent stays there for 30 days, so it is not lost when you close the page. Display preferences, such as sorting and collapsed groups, are stored there too. This local storage stays on your device. When you send a draft, its content is, of course, shared with trygga.
Who else processes your data?
We work with Supabase (database and sign-in), Vercel (the app), Cloudflare (website, spam checks and file storage) and Resend (emails). For website enquiries, ordinary contact emails and support requests from the app, we use Google Workspace, provided by Google Cloud EMEA Limited. Its Cloud Data Processing Addendum applies. Google may process data worldwide; we do not promise exclusive EU storage for the mailbox. More information is available at trygga.io/en/subprocessors/.
The app and database are configured for hosting in Ireland, and files are stored in Cloudflare R2’s EU jurisdiction. This does not mean that all processing by these providers takes place exclusively in the EU. Some are US companies. If this results in a transfer outside the European Economic Area, appropriate safeguards apply, such as the European Commission’s standard contractual clauses. You can ask us for information about the safeguards for your data using our contact address.
How long do we keep your data?
- Website enquiries and follow-up emails: up to one year after your enquiry, or less if no longer needed.
- Your account: for as long as you belong to a workspace. If you have not belonged to any workspace for a year, we delete your account.
- The record of sent emails and in-app notifications: 30 days.
- Supabase Pro platform logs accessible to us: 7 days; Vercel Pro runtime logs: 1 day, without additional log storage. Suppliers’ own retention policies and the needs of security, service delivery and legal obligations apply to their own technical and security logs.
- Invoices: for as long as the law requires.
Database backups are kept for 7 days. There is no separate backup for files in Cloudflare R2.
What rights do you have?
You can ask to access your data, correct inaccurate data or have data deleted. Where applicable, you can also ask for processing to be restricted or for your data to be transferred. You can object to processing based on our legitimate interest.
Email your request to hello@trygga.io. We normally respond within one month. If we are unsure of your identity, we ask for the information needed to check it. If your request concerns content in a workspace, we forward it to the agency.
You can also lodge a complaint with the Belgian Data Protection Authority (https://www.gegevensbeschermingsautoriteit.be/burger/acties/klacht-indienen).